Harvest Now, Decrypt Later: Why Quantum Risk Starts Today

Most security threats need an attacker to act at the moment of the attack. This one does not. An attacker can record encrypted traffic or copy encrypted files today, store them cheaply, and decrypt them years later once a powerful enough quantum computer exists. Security agencies call this “harvest now, decrypt later”. You may also see it called “store now, decrypt later”.

NIST describes it as one of the main reasons the move to post-quantum cryptography is urgent.¹ The US Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency and NIST named it in their joint 2023 quantum readiness factsheet,² and a US executive order signed in June 2026 cites the same risk of adversaries collecting information now to decrypt once large quantum computers work.³ This article explains how the attack works, which data it touches, and how to tell whether yours is in scope.

How The Attack Works

The attack works because of how secure connections are built. As the public-key cryptography article explains, a connection first uses a public-key algorithm to agree a session key, then uses a symmetric cipher such as AES with that key to protect the data. The symmetric cipher is not the weak point. The public-key step that produced its key is, because Shor’s algorithm can solve the underlying factoring or discrete logarithm problem.⁴

NIST’s draft transition guidance makes this link directly. Because the session keys agreed during key establishment protect confidentiality, the harvest risk has to shape the migration timeline for key establishment. NIST applies the same reasoning to email: like any encryption that keeps data confidential, S/MIME email encryption is exposed.¹

What It Does Not Affect

Harvesting is a threat to confidentiality. It is not a threat to digital signatures in the same way. A forged signature only helps an attacker if they can produce it while the signature still matters, which requires a working quantum computer at the time of the attack. NIST states this explicitly: unlike encryption, an authentication system stays secure as long as its algorithms and keys are secure when the authentication happens.¹ A login or handshake that finished years ago cannot be forged after the event.

That does not make signatures a later problem. Some signing keys live for a very long time, such as certificate authority roots and the keys that devices use to check firmware updates. NIST notes that where a device’s verification code cannot be updated after manufacture, the device should be designed to require quantum-resistant signatures if it may still be in service when a quantum computer arrives.¹ Signatures that must keep being trusted for years, such as on contracts, archived records or software, raise a related concern. Once a signing key can be broken, an attacker could create new forgeries under it, possibly carrying an earlier date. A date written by the signer proves nothing on its own, which is why NIST recommends independent evidence such as a timestamp from a trusted authority,⁵ and signatures checked after that point need evidence that does not rest on the old algorithm alone. The urgency for signatures comes from long lifetimes and replacement cycles, not from harvesting.

Judging Whether Your Data Is Exposed

The deciding question is simple: will this data still need to be secret when a cryptographically relevant quantum computer exists? Nobody knows that date. The Q-Day and Mosca’s inequality article gives a structured way to reason about it, including a calculator. The flowchart below is a quicker first pass for a single data flow.

The ten-year threshold in the last question is a prompt, not a standard. It reflects the expert survey figures discussed in the Q-Day article, which put a meaningful chance on a capable quantum computer arriving within a decade. NIST’s own summary is that even if quantum computers are a decade away, organisations need to start migrating now to avoid exposing encrypted data, and it singles out data with long-term sensitivity such as government secrets and medical records.¹

Which Data Matters Most

The most exposed data must stay secret for a long time and travels over networks or sits where attackers can copy it. Health and financial records, intellectual property, government and defence information, identity data and long-term contracts are typical examples. Short-lived data, such as a one-time code that expires in a minute, is far less exposed.

The CISA, NSA and NIST factsheet frames the threat around data that needs long-term confidentiality protection.² In practice, that means the question to ask of each system is how long its data stays sensitive, not how much of it there is.

Where To Start

The first step in almost every government roadmap is to find out where and how your organisation uses cryptography. The CISA, NSA and NIST factsheet recommends a quantum readiness roadmap, a cryptographic inventory, an assessment of supply chain dependencies and early conversations with vendors.² With an inventory in hand you can rank data flows by how long their contents must stay secret and move the most exposed ones to post-quantum key exchange first. The Preparing For Migration group covers that work, and What Governments Expect summarises the deadlines.